In situations such as these the issue of access control delegation is significant [1]}. In such an environment, multiple attributes possessed by an entity need to be validated by multiple different authorities that regulate the access control policies. Delegation denotes the transfer of access rights from one entity to another that is governed by a set of access control policies and associated conditions to access a resource [2]}. That said, the delegation of access rights determines the level of access that must be transferred from one entity to another, governed by the set of access control policies and associated access conditions. In a closed environment, such delegation may be controlled by a central entity employed to perform this function. But when the system grows, for example, in a multi-organisational context, the multi-level delegation needs to be performed over a distributed system spanning across multiple jurisdictions. Given the scale, dynamic nature, and massive network complexity of interconnected devices, users, applications, and services (e.g., in an Internet of Things (IoT) setting [3]}), this becomes a challenging task, in particular, to control resources allowing access only to the authorised users.
